Fixes • WireGuard configs that use HeaderObfuscation now import and can be edited. Opening a  .conf  from Files adds it as a server and keeps its MTU. • A server's own DNS setting is now respected even when Smart DNS is off • Turning off a routing profile puts your previous final policy back instead of leaving traffic DIRECT • All new text is translated into 20 languages

• Proxy Groups: Shadowrocket configs with a [Proxy Group] section now work, including select, url-test, fallback and load-balance groups, region filters and per-rule group routing • Pick per group: choose a server for each group from the Servers tab and the change applies instantly while connected • Provider accounts: Mullvad and IVPN now show which account you are signed in with, and Sign out is easier to find • Cleaner imports: configs are named after the config itself, and MITM hostname lists from Shadowrocket configs and modules import cleanly • Secure DNS fixed: CleanBrowsing and other DoH resolvers reached by address now connect and pass the Test button • WireGuard DNS: profiles that list several DNS servers now use the first one for lookups inside the tunnel • Clearer rules: Add Rule explains that DOMAIN matches one exact host and DOMAIN-SUFFIX includes subdomains Questions or feedback? Tell us on GitHub Issues

• Imported servers show up right away: new servers appear in your list immediately, from any source, with no need to switch tabs • DNS resolver picker fixed: choosing a resolver now turns it on and shows it on the Connect screen, and the list opens faster • Settings stay current: Ad Blocking, IPv6, Free Nodes and other settings now show the right value as soon as you change them • Search everywhere: the Mullvad, IVPN and Supported Providers lists are now searchable. Questions or feedback? Tell us on GitHub Issues

Smart Connect keeps your server, plus a new kill-switch option. Smart Connect keeps your server: if your server has a hiccup (like right after Wi-Fi drops), Smart Connect switches to a backup for that session only. Your chosen server is never overwritten, so you're not drifting to a different server every time you reconnect. Auto-heal still moves you if a server is really down. New: Network Scope (Settings → Tunnel) • Include All Networks (off by default): sends everything through the tunnel, even system traffic that normally skips a VPN. If the tunnel drops, traffic is blocked until it's back. • Exclude Local Networks, Push Notifications and Cellular Services (on by default): AirDrop, printers, notifications and Wi-Fi Calling keep working while Include All Networks is on. Fewer off-tunnel DNS lookups: the IPv6 check now runs reliably once when you connect.

This one is for everybody who told us a connection just sat there. If you use FTP, SSH, mail or anything else where the server speaks first, it now connects with the VPN switched on. Before, it would open and then wait forever for a greeting it never passed along. Last month's update fixed this for apps going through Rocket Proxy directly; this one finishes the job for everything on the VPN. TUIC gets the same treatment, plus long-lived connections stay up. If you left an SSH session or a file transfer running over TUIC and came back to find it dead, that was us letting the connection go quiet for longer than the server was willing to wait. It doesn't any more. Proxy Sharing's "Allow devices on my network" switch now actually does something. It was being saved and then quietly ignored, so the other machines in your house could never reach it. Turn it on and they can.

Getting your servers in just got dramatically easier. Until now, adding a provider meant copying a subscription link out of website, switching apps, and pasting it somewhere. That's finally over. Tap an import link on your provider's site and Rocket Proxy opens, shows you exactly who's asking and what they want to add, and waits for you to say yes. Nothing is added behind your back. There's a new Supported Providers screen too. You'll find the services we work with, with their logos, so you can start from a name you recognize instead of a blank text box. If you're with Mullvad or IVPN, you can sign in with just your account number — no files, no copying, no subscription link to hunt for. Panel users can sign in with the email and password they already have, and the servers arrive on their own. We've also widened what we accept. Configs written for sing-box or Surge now import directly, so you don't need a converter to move over. And WireGuard files from a few more providers now load properly — some of them format things in ways we simply weren't reading before. One fix worth mentioning for WireGuard users: if your config names its own DNS server, that's the one we use now. Before, it got added to a list and raced against ours, which meant your provider's resolver wasn't always the one answering. It is now. As always, tell us what got in your way. It's how these releases get chosen.

Your DNS lookups stop leaking in Local Only. Local Only sends everything direct — that's the point of it. But a VPN app's own network calls bypass its own tunnel, by design, and two of ours were taking advantage of that: some lookups were going out over your normal connection, unencrypted, to resolvers you never picked, while the app sat there telling you DNS was encrypted. It isn't doing that anymore. On the same set of sites, we went from 156 of those to none. Two separate things were causing it. One path assumed there was always a proxy to send the query through, and quietly sent it in the clear when there wasn't. The other treated "that name has no record of this type" as a failed lookup and re-asked the next resolver down the list — which was an unencrypted one. It's a definitive answer, not a failure, so we now take it as one. Being straight with you about what's left: your iPhone still does some name lookups entirely on its own, before we ever see them. Those aren't ours to encrypt, and we're not going to claim otherwise. We're working on what we can reach. Also in this one: we've changed how the app handles IPv6. It now takes responsibility for IPv6 traffic whether or not your network can carry it, instead of leaving it to the system — which is what was letting a handful of lookups escape in the first place. If your connection has no working IPv6, apps fall back to IPv4 cleanly, same as before. You shouldn't notice anything except that fewer things slip past.

A few things that were hidden aren't anymore. Routing has a set of advanced controls — the ones that let you tune how a config actually behaves. They were tucked behind a collapsed row, which meant that unless you happened to tap it, you'd never know they existed. They're now a normal section of the Routing screen, sitting at the bottom. Easy to find if you want them, easy to scroll past if you don't. Tunnel Options has moved there too. It had been filed under diagnostics, which was never really where it belonged — it's a setting you choose, not a tool you troubleshoot with. It now sits with the rest of the per-config controls. As always, if something still takes you more than a moment to find, tell us. That's the kind of report we act on.

Set your own SNI — and have it stay set. You can point any server, free or premium, at the SNI you want. It used to get quietly reset whenever the server list refreshed. Now it sticks, because you chose it. Also in this release: • Fixed a rare case where a server could connect and then move no traffic at all, with no error to explain it. Affected servers repair themselves the first time you open the app — nothing to re-enter. • A shorter, cleaner test server list. Every protocol is still there when you want it, just no longer all installed at once. If a server doesn't behave the way you expect, send it our way.

Hello! This one is all about staying connected. The big fix: on iPhone and iPad, the VPN could be shut down by iOS while you were browsing — you'd look up and find yourself disconnected, usually right when you were busiest. That was us using more memory than we needed to, and iOS reclaiming it. Fixed. Also fixed, all of them causes of dropped or stalled connections: • The tunnel could abort when your phone's clock adjusted — a timezone change or an overnight time sync was enough to kill a working connection. • Connections using WebSocket could stall during setup. • Trojan could drop UDP traffic it should have kept. • Smart Route could quietly pick a different server than the fastest one. • A crash when using xHTTP/HTTP-3. • OpenConnect never actually worked on a real device. It does now. • gRPC is faster — connections now share one channel instead of each opening their own. Importing a server you already have now updates it instead of telling you it's a duplicate. Thank you to everyone who wrote in about dropped connections — the detail in those reports is what let us find the memory problem. Please keep them coming.

Important security fix — please update. Certificate hostname verification was not being applied. We asked the TLS library to check that a server's certificate really belonged to the hostname you had configured, and that check was silently never performed. This affected the secure setting specifically. "Allow Insecure" is off by default, so it was the connections of people who had left verification enabled that were impacted. If you ever turned "Allow Insecure" on to get a server working, please try turning it back off — it should work now, and you will be properly protected. Fixed and verified against real certificate authorities. Also new, both requested by users: • Verify peer certificate by name — check the certificate against a name you choose rather than the address you connect to. Useful when a server is reachable by IP, or when SNI is deliberately set to something else. • Certificate fingerprint (SHA-256) — pin one exact certificate. The connection is refused unless the fingerprint matches, so a certificate authority being compromised is not enough to intercept you. BRING MORE OF YOUR EXISTING SETUP • Rule subscriptions — subscribe to Clash, Stash and Surge rule lists and let them update themselves, instead of pasting rules in by hand. • Stash override modules — import .stoverride files directly. • QuantumultX rewrite files — these used to be discarded without telling you. They now import, and the scripts they reference are fetched so the rules actually run. • Rewrite Sets — a catalogue of ready-made rewrite collections you can browse, subscribe to and manage from one screen. EASIER TO FIND • More is now searchable. Type what you are looking for and go straight to it. • Server names show country flags. • Streaming checks — see whether Netflix, Disney+ and others work through the server you are on, before you settle in for the evening. ALSO FIXED • HTTPS decryption kept serving certificates long after they expired. • Large rule sets parse much faster.

Hello! This update fixes how Rocket Proxy tests your servers — and one of these was a real problem. If your servers are saved with a hostname rather than an IP address, tapping the test button never gave you a time. Not a slow time, no time. That's fixed. The bigger one: when a server refused our connection, we recorded that as an instant reply — the fastest possible result. So a dead server looked like your best server, and Smart Route would pick it first. If Smart Route ever connected you to something that didn't work, this is why. It now judges a server by whether it actually answered. There's also a new way to test. "Through Proxy" sends a real request all the way through the tunnel, so a server that accepts your connection but quietly rejects your credentials now shows up as failing instead of fast. You can choose which test to use, how long to wait, and whether to test everything automatically when the app opens. Two more: you can now import your provider's entire rule set from a single link, under More → Routing Profiles. And if you chose Local Only, then left and came back, the app used to put you back on a proxy server — thank you to whoever reported that; your choice now sticks.

Fixes a bug where a rejected connection could interrupt all internet access instead of just that one connection. Corrects data usage tracking — upload and download totals were reversed, and some traffic was counted twice.

Hello! If you ever connected and then got nothing — the app said "Connected" but pages wouldn't load and your data counter sat at 0 KB — that was us. After connecting, Rocket Proxy checks that traffic is really moving. That check only asked Google and Apple, and if it couldn't reach either of them it assumed the connection was dead and disconnected you. On networks where Google and Apple are blocked, it was hanging up on connections that were working perfectly well. It now asks several independent services at once, and if it still can't tell, it shows you a note and leaves your connection alone instead of dropping it. We've also raised some limits on our side that were cutting off people whose mobile carrier puts many users on one address. If Instagram or TikTok were the things that wouldn't load, that was this, and it's already fixed for you. Thank you to everyone who wrote in. You were right, and the reports are what found it.

Moving in from Clash or Stash? Just paste your config. This is the big one. Rocket Proxy now reads Clash, Stash and Mihomo YAML in full — not just the list of servers, but the parts that actually took you time to get right. Your proxy groups, your rules, your providers, your DNS settings. They come across and they keep working. Paste a link, scan a QR code, open a file, or pull it from iCloud. Then get an honest import report telling you exactly what came across — and if anything didn't, what it was. Also new: • Instant rule packs by QR code, including region-specific presets, so you can get sensible routing in about ten seconds • Switch configurations without dropping your connection • 36 protocols and transports, every one re-tested for DNS leaks before this release went out. We publish how we test, not just the result. • Faster, steadier connections across the board If a config doesn't come across cleanly, send it our way. That's genuinely how this gets better.

What 1.5 is about: a DNS leak, and we're saying so plainly. On WireGuard, AmneziaWG and OpenConnect, some DNS lookups could travel outside the tunnel over the normal connection — so an ISP or network operator could see which sites were being looked up while the app said "connected". Traffic itself was always encrypted and tunnelled; the names leaked. Fixed: every lookup now resolves inside the tunnel.

Hello! Small update with one targeted fix. If you use VMess over gRPC, connections could drop when you had a few tabs or apps pulling at once — fine on a single page, then falling over the moment things got busy. That's fixed. It was our bug, in the part of the code that decides when to slow down and wait rather than push harder. Everything else is unchanged. Other protocols were never affected. Thanks, as always, for the reports that led us to it.

Hello! Let's start with the elephant: in 1.3, VLESS + REALITY connections on iPhone and iPad were broken. Not "slow." Not "occasionally flaky." Broken. It turned out to be a very small mistake in a very deep place, which is the most annoying kind. It's fixed now, and we've added a few guardrails so it can't quietly come back. Also: • Steadier connections across every protocol • Quicker recovery when a server takes its time • Assorted polish for iPhone, iPad, Mac and Apple TV Thanks for bearing with us.

Premium is here. It's a set of fast, dedicated servers with no session limits, for when you want the good stuff. A few other things we think you'll like: • Data Insights show you where your traffic actually goes, plus your speeds over the last day, week, or month. • Smart Connect now quietly picks the fastest server for you — and if one starts to struggle, it fixes things on its own. No fiddling required. • Streaming Mode is one tap for smoother streaming. • There's a new Rule Store for ready-made routing, and a Privacy Dashboard that's honest about what the app can and can't see. (Short version: not your traffic.) • Your servers and settings now sync over iCloud. And, as always, a pile of behind-the-scenes fixes to make everything feel a little smoother. Thanks for using Rocket Proxy. If it's treating you well, a quick rating goes a long way.

More reliable connections across the board. This update makes Rocket Proxy faster and more dependable than ever. We've hardened every proxy protocol and transport for rock-solid stability, with major speed and reliability gains for OpenConnect and VLESS + REALITY. • Faster, more stable connections on all protocols • Big throughput improvements for OpenConnect (DTLS) • Smoother, freeze-free VLESS + REALITY sessions • Better IPv6, DNS, and UDP/QUIC handling • Numerous under-the-hood fixes for a more seamless experience Thanks for using Rocket Proxy — the easiest, most reliable way to secure your traffic with the most advanced protocols. If you're enjoying the app, please consider leaving us a rating on the App Store — it really helps!

Rocket Proxy is the easiest, most reliable way to secure your traffic with the most advanced protocols. This update brings more reliable connections, full IPv6 support, performance improvements, and various bug fixes.